Abordagens para o problema do desbalanceamento em detecção de intrusão: um estudo de caso aplicando CIC-IDS2018

• Ano de defesa: 2024
• Autor(a) principal: Silva, Cristiano Luiz Stresser da
• Orientador(a): Machado, Renato Bobsin
• Banca de defesa: Franco, Edgar Manuel Carreño , Naves, Thiago França
• Tipo de documento: Dissertação
• Tipo de acesso: Acesso aberto
• Idioma: por
• Instituição de defesa: Universidade Estadual do Oeste do Paraná; Foz do Iguaçu
• Programa de Pós-Graduação: Programa de Pós-Graduação em Engenharia Elétrica e Computação
• Departamento: Centro de Engenharias e Ciências Exatas
• País: Brasil
• Palavras-chave em Português: Detecção de intrusão; CIC-IDS2018; LightGBM; Desbalanceamento
• Palavras-chave em Inglês: Intrusion Detection; CIC-IDS2018; LightGBM; Imbalance
• Área do conhecimento CNPq: CIENCIA DA COMPUTACAO::METODOLOGIA E TECNICAS DA COMPUTACAO
• Link de acesso: https://tede.unioeste.br/handle/tede/7258

The exponential growth of digital technologies and the Internet has been accompanied by an alarming increase in cybercrimes. This scenario has motivated the intensification of investments in cybersecurity. Furthermore, studies on the topic are also constantly evolving. Within this context, this work consists of an intrusion detection method that addresses the problems associated with the imbalance present in the CIC-IDS2018 dataset, through pre-processing and model training techniques. The method addresses the combined use of undersampling and oversampling techniques along with weights for cost-sensitive training. With the approach used to address the imbalance, it was possible to provide an improvement in the macro average of the models’ AUC from 92.0% to 98.2%. Additionally, the WebAttack minority class demonstrated an AUC increase from 56.2% to 99.6%. Finally, the mean accuracy obtained was 95.4%, approaching the results of related works. The experiments conducted show that the proposed approach can improve performance on intrusion detection and identification, especially in minority classes, without significantly compromising the overall performance.